Explanation:If the security settings are not configured in the Windows Group policy, the policy uses the default security settings of the device on which it was created. When more than one Windows Group policy is applied to a device, the security settings of the last applied policy are effective on the device.

Action:If you assign multiple policies to a device, ensure that the policy whose security settings you want to be effective on the device is applied last on the device.

The Security settings configured in the Windows Group policy are not applied on a Windows XP SP1 or SP2 managed device

Explanation: The Group Policy Helper tool does not launch on a Windows 7/Vista device if the User Account Control (Start > Settings > Control Panel > User Accounts) is enabled and Mozilla Firefox or any other browser is used.

Action:Configure the Internet Explorer or Mozilla Firefox browser to run with administrator credentials.

To configure Internet Explorer or Mozilla Firefox for a session, right-click the selected browser’s shortcut icon on the desktop, then select Run as administrator.

To configure the Internet Explorer or Mozilla Firefox browser permanently:

On the desktop, right-click the selected browser’s shortcut icon and select Properties. Click the Shortcut tab, then click the Advanced button. In the Advanced Properties dialog box, select Run as administrator.

or

In Windows Explorer, navigate to the Internet Explorer or Mozilla Firefox executable file, right-click the file, then select Properties. Click the Compatibility tab, then select Run this program as an administrator.

Explanation:If you assign more than one policy to a user or a device, the policy enforcement status is not properly displayed.The consolidated status of a Group policy is displayed in the ZENworks icon only for the last enforced policy. That is, if any of the Group policies fail, the last effective policy is displayed in the ZENworks icon as Failed and rest of the policies are displayed as Success.

Possible Cause:The consolidated settings are applied only for the last policy.

Explanation:On the terminal server and Windows Vista devices, the log-on and log-off scripts launching GUI applications do not functional properly because the Graphical User Interface is not launched on the desktop.

Action:Use Directive bundles to launch the GUI applications:

Create a Directive bundle.

Add a Launch Windows Executable action to launch a GUI application, such as mspaint.

Assign the bundle to a device.

Select Launch Schedule, then select the schedule type as Event.

Select the User Login or User Logout event to trigger the schedule.

Assigning an Active Directory Group policy to a user or a device might generate some application event logs on the device

Explanation:If you configure an Active Directory Group policy and assign the policy to a user or a device, some application event logs might be generated on the device even if the policy is successfully enforced on the device.

Action:Ignore the application event logs.

Group policy created on a device with a specific operating system is not enforced on a device with a different operating system

Explanation:The Windows Group policy containing the local group policy settings is not applied on a device if the operating system of the device where the policy is applied is different from the operating system of the device where the policy is created.

Action:Remove the Operating System specific System Requirement from the Windows Group policy and then apply the policy.

However, the security settings are applied only if the operating system version of the device where the policy is applied is later than the operating system version of the device where the policy is created.

Scripts configured through Active Directory Group policy are not enforced on a device

Explanation:The scripts configured through Active Directory group policy are not enforced on a device even though the policy displays success in the ZENworks Adaptive Agent Policies page. However, the other settings if any configured in the policy are enforced on the device.

Action:Configure scripts through Local Group policy.

Security settings that have not been configured in a ZENworks Group Policy are also enforced on a managed device when the ZENworks Group Policy is enforced on the managed device

Explanation:If you create a Windows Group policy through the ZENworks Control Center of a device that already has some security settings configured and assign this policy to a managed device, the security settings that were configured on the device, on which you created the group policy, are also applied on the managed device.

Action: To remove all the previously configured security settings on a device, run the following command before you launch the ZENworks Control Center on the device to create the Group policy:

Explanation:When Group Policy settings are unenforced on a device, URLs added in Favorites and Links do not get removed.

Action:To unenforce the Group Policy settings and restore the system to a clean state, make sure you select the option Delete Existing Favorites and Links, if present, when the system is in the default state prior to applying any policies.

Users need to log in again on a managed device, even though the setting for a forced login is not selected

Explanation:After applying an updated Windows Group Policy on a managed device, logged-in users are forced to log out even though the After enforcement, force a re-login on the managed device, if necessary setting is not selected.

Action:To ensure that a user does not need to log in again to the managed device, deselect the After enforcement, force a re-login on the managed device, if necessary option on any Roaming Profile Policy that is associated with the same user or device.

Explanation:While creating group policy, Failure importing group policy settings error message appear when VC++ 2012 re-distribute package is not installed or MSVCR110.dll is not available in the machine.

Action:Install the VC++ 2012 re-distribute package.

ZENworks plug-ins installed on a device do not show up in the Managed add-ons list in Internet Explorer 8

Explanation:ZENworks plug-ins installed on a device do not appear in the Managed addons list in Internet Explorer 8. Example: Group policy helper plug-in works fine, but does not appear in the managed add-ons list.

Action:Reset the Internet Explorer settings. This will affect the previously configured IE settings. Once listed, the addons can be enabled or disabled. Use the workaround only if it is really necessary to enable or disable the add-on.

Group Policy helper installed using Internet Explorer might not be enabled on Firefox

Explanation:If required Windows update package is not present on a Windows 8.1 machine then, group policy refresh operation does not complete when the user logs out. It completes on next logon. As a result, logon related Group Policy setting do not work as expected.

Possible Cause:Windows updates KB2919394 and KB2911106 are not installed.

Action:Along with other important Windows update, ensure to install KB2919394 and KB2911106 optional updates. And ensure that, Interactive Logon: Do not require CTRL+ALT+DEL setting is set to Disabled in applied Group Policy.

NOTE:Ensure that there is atleast a gap of 30 sec between log off and log on.